coder · BobbyHo · Sep 1, 2026 · Aug 14, 2026 · Aug 17, 2026 · Aug 17, 2026
diff --git a/coderd/oauth2provider/authorize.go b/coderd/oauth2provider/authorize.go
diff --git a/coderd/oauth2provider/authorize_internal_test.go b/coderd/oauth2provider/authorize_internal_test.go
@@ -10,10 +10,12 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
 
 	"cdr.dev/slog/v3/sloggers/slogtest"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestNegotiateScope(t *testing.T) {
@@ -265,6 +267,58 @@ func TestNoScopeAllowlist(t *testing.T) {
 	assert.False(t, noScopeAllowlist(sql.NullString{String: "   ", Valid: true}))
 }
 
+func TestScopeFailureResponse(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name            string
+		err             error
+		wantCode        codersdk.OAuth2ErrorCode
+		wantDescription string
+	}{
+		{
+			name:            "UnknownScope",
+			err:             errUnknownScope,
+			wantCode:        codersdk.OAuth2ErrorCodeInvalidScope,
+			wantDescription: errUnknownScope.Error(),
+		},
+		{
+			name:            "NoGrantableScope",
+			err:             errNoGrantableScope,
+			wantCode:        codersdk.OAuth2ErrorCodeInvalidScope,
+			wantDescription: errNoGrantableScope.Error(),
+		},
+		{
+			name:            "ScopeNotAllowed",
+			err:             errScopeNotAllowed,
+			wantCode:        codersdk.OAuth2ErrorCodeInvalidScope,
+			wantDescription: errScopeNotAllowed.Error(),
+		},
+		{
+			name:            "CoverageUndecidable",
+			err:             errCoverageUndecidable,
+			wantCode:        codersdk.OAuth2ErrorCodeServerError,
+			wantDescription: "The requested scope could not be evaluated",
+		},
+		{
+			// The sentinel still decides the response once wrapped.
+			name:            "WrappedCoverageUndecidable",
+			err:             xerrors.Errorf("negotiate: %w", errCoverageUndecidable),
+			wantCode:        codersdk.OAuth2ErrorCodeServerError,
+			wantDescription: "The requested scope could not be evaluated",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			code, description := scopeFailureResponse(test.err)
+			require.Equal(t, test.wantCode, code)
+			require.Equal(t, test.wantDescription, description)
+		})
+	}
+}
+
 func TestHashOAuth2State(t *testing.T) {
 	t.Parallel()
 
@@ -306,3 +360,49 @@ func TestHashOAuth2State(t *testing.T) {
 			"same state should produce identical hash")
 	})
 }
+
+func TestConsentScopes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		granted          string
+		want             []string
+		wantUnrestricted bool
+	}{
+		{
+			name:    "NarrowGrantListed",
+			granted: "workspace:ssh template:read",
+			want:    []string{"workspace:ssh", "template:read"},
+		},
+		{
+			// nil, not the name: the page says "full access" instead.
+			name:             "UnrestrictedAloneCollapses",
+			granted:          string(database.ApiKeyScopeCoderAll),
+			want:             nil,
+			wantUnrestricted: true,
+		},
+		{
+			name:             "UnrestrictedAmongOthersCollapses",
+			granted:          string(database.ApiKeyScopeCoderAll) + " coder:workspaces.access",
+			want:             nil,
+			wantUnrestricted: true,
+		},
+		{
+			// Unreachable today: negotiateScope returns "" only with an error.
+			name:             "EmptyGrantIsNotUnrestricted",
+			granted:          "",
+			want:             []string{},
+			wantUnrestricted: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			names, unrestricted := consentScopes(test.granted)
+			require.Equal(t, test.want, names)
+			require.Equal(t, test.wantUnrestricted, unrestricted)
+		})
+	}
+}